Getting Data In

running permissions for splunk user of forwarder on linux and solaris

fernandoandre
Communicator

Hi

I have some universal forwaders installed on linux (suse) and solaris.

I have a user "splunk" to log to those machines and make restart to the forwarder service if necessary.

However, if I do that with splunk user, the forwarder stops sending data to my Indexer. If however I do that with a root user, the forwarder starts sending data again to Indexer.

What are the permissions a user needs to controls the splunk forwarder service in a *nix machine??

(this doesnt help - http://docs.splunk.com/Documentation/Splunk/4.3/installation/RunSplunkasadifferentornon-rootuser)

Thank you

0 Karma
1 Solution

fernandoandre
Communicator

Problem solved!
The user need read permissions to the folder where logs are being written (which it didn't have)! It doesn't have to do with the permissions for starting/stopping the service of the forwarder.

View solution in original post

0 Karma

fernandoandre
Communicator

Problem solved!
The user need read permissions to the folder where logs are being written (which it didn't have)! It doesn't have to do with the permissions for starting/stopping the service of the forwarder.

0 Karma

krishnacasso
Path Finder

Can you please guide how you assigned the permissions to log file. I used chmod to assign the read permissions but it is not working. When the file get rolled over the permissions were not carried so forwarder stops sending the data.

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...